← CVE Intelligence

CVE-2026-48902

Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links PUBLISHED

Description (CNA)

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

Affected (CNA)

Vendor / productVersions
Joomla! Project / Joomla! CMSaffected 3.9.0-5.4.5; affected 6.0.0-6.1.0

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.